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JUN 2 3 2008 

AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions and listings of claims in the application: 



LISTING OF CLAIMS: 



1-6. (Canceled) 

7. (Currently Amended) In a computer system including (a) a host compute r, (b) a 
storage system coupled to and separate from a^said storage system which has t he storage 
system having a first volume for storing data received from the host computer^ and-a second 
volume that is a pair of said first volume and that stores data that is replicated from said first 
volume, and a storage control unit for controlling the data replication from the -said first 
volume to said second volume, and ( c) a data protection apparatus coupled to and separate 
from the host computer and the storage system, the data protection apparatus comprising: 

an event detection unit in said data protection apparatus for detecting an event 
occurrence; 

a replication stopping uni t in said data protection apparatus for instructing said storage 
control unit to stop the replication of data of said first volume to said second volume, when 
said event detection unit detects an event; and 

an Hlogol intrusion d e f e ction unit for d e tecting an illegal intrusion into said host 
comput e r; 
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wher e in said ev e nt det e ction unit receives a d e t e ction of th e ill e gal intrusion from said 
ill e gal intrusion d e t e ction unit; and 

when said e v e nt detection unit receives the det e ction of th e ill e gal intrusion, said 

replication sto p ping unit instructs said storag e control unit to stop data replication from said 
first volum e to said s e cond volume that is tho pair of said - fir s t volume 

wherein said replication stopping unit instructs said storage control unit to stop the 

data replication from said first volume to said second volume when said event detection unit 
receives an event detection of an illegal intrusion from an illegal intrusion detection unit, in 
the host computer, which detects the illegal intrusion into said host computer . 

8. (Canceled) 

9. (Currently Amended) A data protection apparatus in a computer system according to 
Claim 7, 

wherein^ said host c omputer sy s t e m further includes a computer virus detection unit 

for detecting a computer virus in s aid storag e syst e m ; 

said event detection unit receives the dot e e tion of th e comput e r virus from said 
computer virus det e ction unit; a nd 

wherein when said event detection unit receives & the-detection of the computer virus, 
from said computer virus detection unit, said replication stopping unit instructs said storage 
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control unit to stop data replication from said first volume to said second volume that is the 
pair of said first volume. 



10. (Cunently Amended) A data protection method for protecting data in a computer 
system including (a) a host compute r,^ a storage system coupled to and separate from a- said 
storage system which has said storage system having a first volume for storing data received 
from the host computer^ and^a second volume that is a pair of said first volume and that 
stores data that is replicated from said first volume, and a storage control unit coupl e d to and 
separate from said storag e syst e m for controlling data replication from said first volume to 
said second volume, and (c) a data protection apparatus coupled to and separate from the host 
computer and the storage system, ^ w h e r e in s aid the data protection method comprises steps of; 

detecting an intrusion into said host computer; and 

instructing said storage control unit to stop data replication from said first volume to 
said second volume when said intrusion is detected : and . 

stopping data re plication from said first volume to said second volume in response to 
said instructing . 

» 

1 1 . (Currently Amended) A program recorded on a computer readable medium e mbodied 
on a storage medium that can bo read by an information processing apparatus for making the 
information processing apparatus perform data protection in a computer system including a 
host computer coupled to and separate from a storage system which has a first volume for 
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storing data received from the host computer and a second volume that is a pair of said first 
volume and that stores data that is replicated from said first volume, and a storage control unit 
coupled to and separate from said storage system for controlling data replication from said 
first volume to said second volume, wherein said program makes said information processing 
apparatus perform processes of: 

detecting that an intrusion into the host computer has occurred;-and 
instructing said storage control unit to stop data replication from said first volume to 
said second volume when said intrusion is detected ; and 

stopping data replication from said first volume to said second volume in response to 

paid fostructing. 

12.-13. (Canceled) 

14. (Currently Amended) In a computer system including a host computer coupled to and 
separate from a storage system which has a first volume for storing data received from the 
host computer and a second volume that is a pair of said first volume and that stores data that 
is replicated from said first volume, and a storage control unit coupled to and separate from 
said storage system for controlling data replication from the first volume to said second 
volume, a data protection apparatus coupled to and separate from the host computer and the 
storage apparatus system comprising: 

an event detection unit for detecting an event occurrence; and 
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a replication stopping unit for instructing said storage control unit to stop data 
replication from said first volume to said second volume when said event detection unit 
detects an event; 

wherein said computer system further comprises an alteration detection unit that reads 
given data in a plurality of said second volumes to detect respective differences between the 
given data; and 

the event detected by said event detection unit is a detection result of the differences 
between the given data, with said detection result being received from said alteration 
detection unit, 

15. (Previously Presented) A data protection apparatus in a computer system 
according to Claim 14, wherein: 

write data to said first volume is replicated by said storage control unit to said second 
volume with a delay of a given time. 

1 6. (Previously Presented) A data protection apparatus in a computer system 
according to Claim 14, wherein: 

as said second volume, a plurality of second volumes are provided; and 
said storage control unit switches a replication destination of write data of said first 
volume, at given time intervals among said plurality of second volumes. 
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1 7. . (Previously Presented) A data protection apparatus in a computer system 
according to Claim 16, wherein: 

data replicated to said plurality of second volumes is further replicated to another 
plurality of said second volumes. 

18. (Canceled) 

1 9. (Previously Presented) A data protection apparatus in a computer system 
according to Claim 14, wherein: 

said storage control unit further controls communication between said host computer 
and said first volume; and 

said data protection apparatus instructs said storage controller to stop communication 
between said host computer and said first volume when said event detection unit detects said 
event. 

20. -21. (Cancelled) 

22. (Previously Presented) A data protection apparatus in a computer system according 
to Claim 7, further including a path disconnection unit for instructing said storage control unit 
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to stop communication between said host computer and said storage system, when said event 
detection unit detects an event. 

23. (Canceled) 

24. (Currently Amended) A data protection method according to Claim 10, further 
including the step of instructing said storage control unit to stop communication between said 
host computer and said storage system, wh e n said when said intrusion is detected. 

25. (Canceled) 

26. (Currently Amended) A program recorded on a computer readable medium, 
e mbodi e d on a storage m o dium according to Claim 1 1 9 further including s aid program 
making said information processing apparatus p e rform the proc e ss of instructing s aid storag e 
control unit to s top sto pping communication between said host computer and said storage 
system,, with said storage control unit w hen said-when said intrusion is detected. 

27. (Canceled) 

28. (Currently Amended) A data protection apparatus in a computer system according to 
CIaim-?i4» further including a path disconnection unit for instructing said storage control unit 

8 



PAGE 12/19* RCVD AT 6/23/2008 10:01:39 PM [Eastern Daylight TimeJ* SVfcUSPTO-EFXRF-5/12* DlflS:2738300 * CSID703 684 1157 ' DURATION (mm-ss):03-34 



06-23-' 08 21:59 FROM-Mattingly., St anger 703-684-1157 T-561 P013/019 F-625 



Appl. No. 1 0/803,945 Docket No. TSM-37 

Amendment 

Response to Office Action mailed January 22, 2008 

to stop communication between said host computer and said storage system, when said event 
detection unit detects an event. 

29, (New) A data protection apparatus in a computer system according to claim 7, 

wherein said data replication from said first volume to said second volume is delayed 
by a predetermined time after said host computer writes data to said first volume. 
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